Bank of America Fined $1.2 Billion for Money-Laundering Failures, What Went Wrong, Which Laws Were Broken, and What Happens Next

On October 13, 2026, the U.S. Department of the Treasury announced coordinated enforcement actions imposing more than $1.21 billion in penalties and settlements against Bank of America, N.A., the second-largest bank in the United States. The actions target long-running failures in the bank’s Bank Secrecy Act / anti-money-laundering (BSA/AML) compliance program and a separate set of sanctions violations.

Bank of America did not simply miss one suspicious payment. Regulators found that its transaction-monitoring system had serious gaps, that it filed suspicious activity reports (SARs) late or not at all on more than $5 billion in transactions, that it ignored internal and external warnings, and that it failed to fix these problems even after a December 2024 cease-and-desist order. The bank admitted it willfully violated the Bank Secrecy Act.

Important: This is a government regulatory enforcement action. It is not a consumer class action, and there is no claim form, settlement website, or payout for ordinary customers.

Quick Facts

Item	Details
Bank	Bank of America, N.A.
Announcement Date	October 13, 2026
Total Penalties and Settlement	More than $1.21 billion (about $1.212 billion)
FinCEN Penalty	$1.2 billion, for Bank Secrecy Act violations
OCC Civil Money Penalty	$750 million, the largest in OCC history; credited against the FinCEN penalty
OFAC Settlement	$11,662,930 for 475 apparent sanctions violations
Key Admission	The bank admitted it willfully violated the Bank Secrecy Act
Late or Unreported Suspicious Activity	More than $5 billion, including more than $1 billion tied to national-security and priority illicit-finance risks
Core Failures	Deficient AML program, late SARs, inadequate correspondent-account due diligence, weak customer due diligence
Earlier Warning	OCC cease-and-desist order, December 23, 2024
Risks Cited	Chinese money-laundering networks, fraud, potential trade-based money laundering, illicit finance linked to the U.S. southwest border
Criminal Charges	None announced as part of this action; all three actions are civil
Consumer Payout or Claim Form	None
Impact on Earnings	Bank expected a charge of about $1.2 billion in Q3 2026 results

Why Was Bank of America Fined More Than $1.21 Billion?

Banks are legal gatekeepers of the financial system. They must monitor transactions, investigate warning signs, and report qualifying suspicious activity to the federal government. Regulators found that Bank of America did not reliably do this.

The bank failed to report more than $5 billion in suspicious transactions to the Financial Crimes Enforcement Network (FinCEN) on time. More than $1 billion of that involved priority illicit-finance and national-security risks, including activity indicative of Chinese money-laundering networks, fraud, and potential trade-based money laundering connected to the southwest border.

The bank also failed to correct significant weaknesses after the Office of the Comptroller of the Currency (OCC) ordered it to improve in December 2024. The October 2026 action therefore addresses two linked problems: the original compliance failures, and the failure to fix them once regulators had ordered it.

Important distinction: A suspicious transaction is not automatically a criminal transaction. The action concerns the bank’s legal duty to monitor, investigate, and report, not a finding that every dollar involved was criminal proceeds.

How Much Is Bank of America Actually Paying?

Three federal agencies announced related actions, which makes the headline number confusing.

Agency	Amount	What It Covers
FinCEN	$1.2 billion	Bank Secrecy Act violations, AML program failures, late suspicious-activity reporting
OCC	$750 million	Civil penalty for deficient BSA/AML compliance; credited against the FinCEN penalty
OFAC	$11,662,930	475 apparent sanctions violations

The OCC’s $750 million is credited against the FinCEN penalty. The two should not be added together to reach $1.95 billion. Adding the separate OFAC settlement gives the combined total of roughly $1.212 billion.

What Did Bank of America Do Wrong?

The enforcement documents describe failures across technology, people, and management.

1. Its Transaction-Monitoring System Missed Suspicious Activity

Banks use automated systems to review payments, wires, and deposits and to raise alerts when activity does not fit a customer’s profile. Bank of America relied heavily on a proprietary system called Event Processor, which FinCEN found had significant design and coverage gaps.

The system did not reliably catch certain money-order deposits, third-party payments, and transactions tied to high-risk customers. Its thresholds and models also delayed investigations. After the bank adjusted the system’s parameters, its own review identified nearly $4 billion in suspicious activity that would not otherwise have been investigated and reported on time, and nearly 8,900 SARs that had not been filed under the earlier settings.

Having software is not enough. A monitoring system must actually detect the risks the bank is legally required to monitor.

2. It Failed to File Suspicious Activity Reports on Time

A SAR alerts FinCEN and law enforcement to potentially illegal activity. It is not an accusation, and filing one does not mean the customer committed a crime. Federal rules generally require a bank to file within 30 calendar days after it first detects facts that may justify a report.

FinCEN found that Bank of America filed late on more than $5 billion in suspicious transactions. Some reports came months after the activity, partly because the bank’s process grouped transactions together for long periods before investigators reviewed them. Some reports were also inaccurate or incomplete. Late intelligence is far less useful to investigators trying to trace funds and connect criminal networks.

3. It Did Not Adequately Investigate High-Risk Auto-Auction Customers

One of the most detailed findings involved two corporate customers in the online auto-auction industry that handled large volumes of payments for used and salvaged vehicles. Some payments came as money orders and other instruments bought at third-party institutions, often from people other than the registered buyers.

Third-party payments are not illegal by themselves, but they make it harder to know who supplied the money and why. From 2018 through 2025, these customers processed tens of billions of dollars in negotiable-instrument deposits. The bank failed to report more than $600 million in suspicious money-order deposits on time. Regulators cited warning signs consistent with trade-based money laundering and fraud, and some activity had a southwest-border connection.

The bank’s models did not adequately cover these deposits and did not sufficiently separate money orders from other instruments. Compliance staff raised concerns about third-party payments and unusual volumes, yet the bank did not consistently update risk ratings, strengthen monitoring, or act in time.

What this does not mean: The findings do not establish that every auto-auction customer or every payment involved criminal money.

4. It Relied Too Heavily on Outside Warnings

Treasury found that Bank of America depended too much on law enforcement inquiries, requests from other banks, and manual referrals to find suspicious activity. In multiple years, more than one-third of its suspicious-activity investigations were triggered by outside events rather than its own automated controls.

Banks have an independent duty to monitor. They cannot wait for police, prosecutors, or other banks to point out risk. Where outsiders had already flagged a customer, the bank did not meaningfully improve its monitoring.

5. It Did Not Respond Adequately to Internal Warnings

FinCEN said the bank received repeated warnings from compliance staff and testing functions, along with concerns from law enforcement and other institutions, but did not consistently change its practices. In some cases, compliance staff recommended stronger controls, including considering ending a customer relationship, and the bank did not always follow through promptly.

Treasury stated that the bank prioritized revenue and minimized the compliance resources it needed. An effective program depends on management giving compliance staff the people, technology, training, and authority to act.

6. Staffing, Training, Audit, and Oversight Were Inadequate

The OCC found that the bank’s BSA officer and staff lacked the expertise and training needed to run the program effectively. The audit function failed to detect long-standing problems that examiners later found. Management did not ensure the program worked and kept minimizing deficiencies even after the December 2024 order.

These systemic findings help explain why the penalty was so large.

7. Customer Due Diligence and Foreign Correspondent Due Diligence Gaps

Customer due diligence failures were a recurring theme. Customers who relied heavily on payments from unknown third parties were not adequately addressed, including activity with red flags for possible narcotics proceeds and trade-based money laundering. In its admissions to FinCEN, the bank acknowledged it also failed to conduct required due diligence on correspondent accounts for foreign financial institutions.

How Did Regulators Discover the Problems?

There was no single moment when one transfer exposed everything. The record shows a gradual process.

Step 1: Internal alerts and compliance reviews. The bank’s own systems and compliance staff flagged unusual patterns such as high money-order volumes, third-party payments, and high-risk international wires. Internal testing also exposed weaknesses in how alerts were generated and escalated.

Step 2: Other banks and law enforcement. Inquiries from other financial institutions about suspicious money-order transactions, along with law enforcement investigations and information requests, exposed activity the bank had not adequately addressed.

Step 3: OCC examinations and the 2024 order. The OCC examined the program and found deficiencies in suspicious-activity reporting, customer due diligence, internal controls, governance, independent testing, and training. On December 23, 2024, it issued a cease-and-desist order requiring corrective action, an independent consultant, and lookback reviews.

Step 4: FinCEN’s investigation. FinCEN examined monitoring weaknesses, customer due diligence, reporting failures, and priority illicit-finance risks, and identified the more than $5 billion in late-reported suspicious activity.

Step 5: Independent testing. A third-party review in 2025 found additional gaps, including poorly calibrated risk factors and insufficient monitoring for certain trade-based money-laundering warning signs. The OCC found many required corrective steps had not been completed.

On October 13, 2026, Treasury announced the FinCEN and OCC penalties, and OFAC announced its separate settlement.

What Was the December 2024 OCC Order, and Why Does It Matter?

The 2024 order is central to understanding the size of the 2026 penalty. It cited failures to file SARs promptly and a failure to correct a previously identified customer due diligence deficiency, along with weak internal controls, governance, independent testing, and training. It required comprehensive corrective action, an independent consultant, and lookback reviews to determine whether suspicious activity had been properly reported.

The 2026 OCC action found significant problems remained. According to the OCC, the bank kept filing late SARs involving billions of dollars, failed to escalate potentially suspicious activity to investigators, and allowed potential trade-based money laundering to continue because of monitoring gaps. A first-time compliance failure is serious. A failure that continues after a formal order is treated far more severely.

The OFAC Sanctions Settlement

Separately, Bank of America settled with the Office of Foreign Assets Control (OFAC) for 475 apparent violations across multiple sanctions programs, including those targeting Russia, Belarus, Iran, Burma, Somalia, narcotics trafficking, and global terrorism.

The violations involved payments through or involving blocked parties, caused by technical and human errors, failure to prioritize alerts for customers matching blocked persons, delayed watchlist updates, and mishandling of two business accounts connected to blocked persons. OFAC determined the violations were non-egregious but largely not voluntarily self-disclosed. The settlement amount is $11,662,930.

Sanctions compliance and anti-money-laundering compliance are related but legally distinct. Sanctions compliance asks whether a transaction involves prohibited persons, places, or activities. AML compliance asks whether suspicious activity is being identified and reported.

Which Laws Apply? Legal Framework Explained

Several federal laws and regulations govern this conduct. They cover different duties, so each finding should not be treated as the same violation.

1. The Bank Secrecy Act (31 U.S.C. § 5311 et seq.)

The BSA is the main law behind the FinCEN penalty. It requires financial institutions to keep records and report certain transactions and suspicious activity to help authorities detect and investigate financial crime. Bank of America admitted in the FinCEN consent order that it willfully violated the BSA by failing to maintain an AML program meeting minimum requirements, failing to conduct required correspondent-account due diligence, and failing to file SARs.

In civil enforcement, “willfulness” can be established through reckless disregard or willful blindness. The admission does not necessarily mean the bank intended to help criminals launder money. The BSA’s civil penalty authority is found in 31 U.S.C. § 5321, and FinCEN’s implementing civil-penalty rules appear in 31 C.F.R. § 1010.820.

2. AML Program Requirements (31 U.S.C. § 5318(h); 31 C.F.R. § 1020.210; 12 C.F.R. § 21.21)

Banks must maintain a risk-based AML program with internal controls, a designated BSA compliance officer, ongoing employee training, and independent testing. The OCC’s rule for national banks, 12 C.F.R. § 21.21, requires a program reasonably designed to ensure BSA compliance. The OCC found Bank of America’s program deficient, with failures in monitoring, controls, expertise, training, and audit.

3. Suspicious Activity Reporting (31 U.S.C. § 5318(g); 31 C.F.R. § 1020.320; 12 C.F.R. § 21.11)

Banks must file a SAR when they know, suspect, or have reason to suspect a transaction involves illegal funds, is designed to evade reporting requirements, or has no apparent lawful purpose. A bank does not have to prove a crime before filing. The standard filing deadline is generally 30 calendar days after initial detection of facts that may justify a report, with additional time in limited cases where no suspect is identified.

Two related protections matter for readers. SAR filings are confidential, and banks are prohibited from tipping off the subject (31 U.S.C. § 5318(g)(2)). Banks also receive a safe harbor from civil liability for good-faith SAR filings (31 U.S.C. § 5318(g)(3)).

4. Customer Due Diligence and Beneficial Ownership (31 C.F.R. § 1010.230; 31 C.F.R. § 1020.220)

Banks must verify customer identity under the Customer Identification Program rule (31 C.F.R. § 1020.220, implementing Section 326 of the USA PATRIOT Act). Under the CDD Rule (31 C.F.R. § 1010.230), they must also identify and verify the beneficial owners of legal-entity customers, understand the nature and purpose of customer relationships, and conduct ongoing monitoring to maintain and update customer risk profiles.

5. Foreign Correspondent Account Due Diligence (31 U.S.C. § 5318(i); 31 C.F.R. § 1010.610)

Banks maintaining U.S. correspondent accounts for foreign financial institutions must apply risk-based due diligence to detect and report known or suspected money laundering. This provision, which came from Section 312 of the USA PATRIOT Act, is the source of the correspondent due diligence admission in this case.

6. Currency Transaction Reports and Structuring (31 U.S.C. § 5313; 31 C.F.R. § 1010.311; 31 U.S.C. § 5324)

Banks must file a Currency Transaction Report for cash transactions over $10,000 in a business day. Deliberately breaking up transactions to avoid that report, known as structuring, is itself a federal offense under 31 U.S.C. § 5324. Monitoring for structuring is a core part of any AML program.

7. OCC Enforcement Authority (12 U.S.C. § 1818)

The OCC’s cease-and-desist and civil-money-penalty powers over national banks come from 12 U.S.C. § 1818. That authority underlies the December 2024 order and the $750 million assessment. The OCC cited 12 C.F.R. §§ 21.21 and 21.11 as the specific BSA-related rules for the program and SAR violations.

8. Sanctions Law (IEEPA, 50 U.S.C. § 1701 et seq., and OFAC regulations in 31 C.F.R. Chapter V)

OFAC enforces economic sanctions under the International Emergency Economic Powers Act and related statutes, through country-based and list-based programs. OFAC resolves cases under its Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A), which is where the “egregious / non-egregious” and “voluntary self-disclosure” distinctions come from.

9. Criminal Money-Laundering Statutes (18 U.S.C. §§ 1956 and 1957)

Federal criminal law prohibits laundering the proceeds of specified unlawful activity and engaging in monetary transactions in criminally derived property over $10,000. These are separate from this case. The October 2026 action is civil, and nothing in it establishes that Bank of America was convicted of, or even charged with, criminal money laundering.

10. The Anti-Money Laundering Act of 2020 and the Whistleblower Program (31 U.S.C. § 5323)

The Anti-Money Laundering Act of 2020 modernized the BSA, strengthened FinCEN’s enforcement tools, and expanded whistleblower protections and awards for people who report BSA and sanctions violations. Information about the program is available on FinCEN’s website.

Who Is Most Responsible?

Bank of America bears direct regulatory responsibility. It admitted the BSA violations in the FinCEN consent order and agreed to the penalty and corrective obligations. It was responsible for effective monitoring, customer due diligence, staff training, and timely reporting.

Senior management faced criticism for oversight failures. Treasury and the OCC said management failed to ensure the program worked, minimized known deficiencies, and did not complete remedial steps required by the 2024 order on time. Treasury said the bank prioritized revenue over compliance resources. However, the public record does not establish that any individual executive knew about every transaction or personally took part in money laundering. No individual charges were announced.

Compliance and audit functions also fell short. The OCC found the BSA officer and staff lacked sufficient expertise and training, and that audit missed long-standing problems. At the same time, employees who raised concerns should not automatically be blamed for failures management did not resolve.

What about the regulators? Regulators had ordered improvements in December 2024 and still found major problems afterward, which raises fair questions about how quickly large banks can be compelled to fix deficiencies. But the record does not show regulators caused the failures. Responsibility for maintaining the required systems rested with the bank.

Was Bank of America Actually Laundering Money?

The enforcement action establishes serious compliance and reporting failures. It does not establish that every transaction was criminal or that the bank itself knowingly took part in every underlying scheme.

Money laundering generally means disguising the criminal origin of funds. A bank can violate AML laws by failing to monitor or report suspicious activity even when regulators have not proven the bank itself committed the underlying crime. The bank’s admission of “willful” BSA violations is significant, but it should be read under the civil standard of reckless disregard or willful blindness described in the consent order.

What Must Bank of America Do Now?

The orders require the bank to:

• Pay the penalties assessed by FinCEN, the OCC (credited against FinCEN’s), and OFAC.
• Complete a third-party lookback of past transactions to identify suspicious activity that was missed.
• File overdue SARs for previously undetected activity where required.
• Improve transaction monitoring and correct weaknesses in its automated system and investigation processes.
• Strengthen customer due diligence, including how third-party payments, high-risk jurisdictions, and unusual activity affect risk ratings.
• Improve foreign correspondent due diligence.
• Upgrade staff expertise, training, independent testing, and governance, including data governance.
• Fix sanctions compliance gaps involving alerts, watchlists, and payment processing.
• Comply with both the 2024 cease-and-desist order and the new consent order.

The bank has said it is committed to completing the required work and that it has invested billions of dollars in financial-crime compliance technology and personnel. It expected a non-tax-deductible charge of about $1.2 billion in its third-quarter 2026 results, reducing quarterly net income by roughly 17 cents per share. The actions do not impose an asset cap or stop the bank from operating.

Could the Bank or Its Executives Face More Legal Action?

The October 2026 actions are civil, and the Department of Justice has not announced a criminal resolution. The lookback review could surface additional information relevant to other investigations, but the official announcements do not establish that criminal charges against the bank or any executive have been filed or are imminent. Any future criminal case would require its own legal basis and evidence, and individual liability would depend on each person’s own conduct, knowledge, and duties.

It would be inaccurate to say executives are about to be arrested or that the bank has been convicted of criminal money laundering based on this civil enforcement alone.

What Does This Mean for Bank of America Customers?

• Your deposits are not affected. The penalties are paid by the bank. Deposits remain FDIC-insured up to the standard limit of $250,000 per depositor, per insured bank, per ownership category.
• There is no claim form or payout. These are government penalties, not a class action. Ordinary depositors, credit-card holders, and other retail customers are not entitled to refunds or payments, and no compensation fund has been announced.
• Your account is not automatically suspected. The action concerns the bank’s compliance systems, not a finding that customer accounts were broadly involved in wrongdoing.
• You may notice stricter checks. As the bank improves its controls, customers may be asked for updated information, extra questions on large or international transfers, or occasional holds on unusual activity.
• Beware of scams. Fraudsters may exploit news like this. If you receive a request for updated information, contact the bank through its official website or the number on your card, not through links in unsolicited messages.
• Report concerns properly. Anyone with information about possible BSA or sanctions violations can look into FinCEN’s whistleblower program, and consumers with account complaints can use the bank’s official channels or the Consumer Financial Protection Bureau.

Why This Case Matters for the U.S. Financial System

Banks are a front line against fraud, drug trafficking, sanctions evasion, and organized crime. Their reports help investigators connect transactions and trace funds. When a major bank reports late or not at all, those opportunities can be lost.

This case is notable for the amount of unreported activity, the national-security risks identified, the record OCC penalty, and the continuation of problems after a formal order. A bank cannot rely only on software, outside law enforcement requests, or occasional manual reviews. Its own controls must identify risk, escalate concerns, and produce timely, useful reports. Other banks are likely to review their own monitoring systems, risk models, training, and escalation procedures in response.

Frequently Asked Questions

How much was Bank of America fined for money-laundering failures?

Treasury announced more than $1.21 billion in combined penalties and settlements on October 13, 2026. FinCEN assessed $1.2 billion, which credits the OCC’s $750 million penalty, and OFAC separately announced an $11,662,930 sanctions settlement.

Did Bank of America admit to money laundering?

The bank admitted willful violations of the Bank Secrecy Act, including failures in its AML program, due diligence, and suspicious-activity reporting. The action does not establish that the bank itself knowingly laundered every dollar involved.

How much suspicious activity did the bank fail to report on time?

FinCEN said more than $5 billion, including more than $1 billion involving priority illicit-finance and national-security risks.

What was the role of Chinese money-laundering networks?

Treasury said some unreported activity was indicative of Chinese money-laundering networks. The action also involved potential trade-based money laundering, fraud, and risks tied to the southwest border. These descriptions do not mean every transaction or customer was proven criminal.

How did regulators find out?

Through internal alerts and reviews, inquiries from other banks, law enforcement activity, OCC examinations, independent testing, and FinCEN’s investigation. The OCC had already issued a cease-and-desist order in December 2024.

Why was the penalty so large?

Regulators found systemic weaknesses in monitoring, customer due diligence, reporting, training, audit, and management oversight, and the problems continued after the bank was ordered to fix them.

Can customers claim money from the fine?

No. This is not a customer compensation settlement, and there is no claim process for Bank of America customers.

Is the $750 million OCC penalty on top of the $1.2 billion FinCEN penalty?

No. It is credited against the FinCEN penalty. Only the OFAC settlement is separate.

Could executives be criminally charged?

The civil actions do not establish that. Any prosecution would need separate evidence and a legal basis.

Is my money in Bank of America safe?

The penalties do not affect FDIC deposit insurance or day-to-day banking services.

What happens next?

The bank must complete lookback reviews, file previously missed SARs, strengthen its controls, and undergo independent assessments, while regulators assess whether the deficiencies have been corrected.

Key Dates

Date	Event
2018 to 2025	Period of high-volume money-order deposits by two auto-auction customers cited by FinCEN
December 23, 2024	OCC issues cease-and-desist order for BSA deficiencies
2025	Third-party review identifies continuing monitoring gaps
October 13, 2026	Treasury announces FinCEN $1.2 billion penalty, OCC $750 million penalty, and OFAC $11,662,930 settlement
Q3 2026	Bank expects roughly $1.2 billion charge in quarterly results

Sources and References

1. U.S. Department of the Treasury, press release announcing enforcement actions against Bank of America, October 13, 2026
2. Financial Crimes Enforcement Network (FinCEN), “FinCEN Assesses $1.2 Billion Penalty against Bank of America,” October 13, 2026
3. FinCEN, Bank of America Consent Order Imposing Civil Money Penalty, Case No. 2026-03
4. Office of the Comptroller of the Currency (OCC), News Release 2026-89 and civil money penalty order, October 13, 2026
5. OCC, News Release 2024-140 and Cease-and-Desist Order AA-ENF-2024-56, December 23, 2024
6. Office of Foreign Assets Control (OFAC), Settlement Agreement and Enforcement Release, October 13, 2026
7. Reuters, report on Bank of America penalty and third-quarter charge, October 13, 2026
8. Bank Secrecy Act, 31 U.S.C. § 5311 et seq., including §§ 5313, 5318, 5321, 5323, and 5324
9. 31 C.F.R. §§ 1010.230, 1010.311, 1010.610, 1010.820, 1020.210, 1020.220, and 1020.320
10. 12 C.F.R. §§ 21.11 and 21.21; 12 U.S.C. § 1818
11. 18 U.S.C. §§ 1956 and 1957; 50 U.S.C. § 1701 et seq.; 31 C.F.R. Part 501, Appendix A
12. USA PATRIOT Act, Sections 312 and 326; Anti-Money Laundering Act of 2020

This article provides general legal and regulatory information only and is not legal or financial advice. AllAboutLawyer.com is not a law firm. It distinguishes Bank of America’s admissions and the regulators’ findings from allegations about underlying criminal activity; a suspicious transaction is not, by itself, proof of money laundering. Enforcement outcomes and remediation requirements are determined by the agencies and the terms of the consent orders.